Copy ssh and ssh.txt to boot partition

debconf alone does not seem to work

.dockerignore

@@ -0,0 +1,3 @@
+output/
+work/
+deploy/

Dockerfile

@@ -0,0 +1,12 @@
+FROM debian:jessie
+
+RUN apt-get -y update && \
+    apt-get -y install \
+        git vim parted \
+        quilt realpath qemu-user-static debootstrap zerofree pxz zip dosfstools \
+        bsdtar libcap2-bin rsync grep \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY . /pi-gen/
+
+VOLUME [ "/pi-gen/work", "/pi-gen/deploy"]

README.md

@@ -1,13 +1,14 @@
-#TODO
+# pi-gen
+_Tool used to create the raspberrypi.org Raspbian images_
 
-1. Simplify running a single stage
+### TODO
 1. Documentation
 
-#Dependencies
+## Dependencies
 
-`quilt kpartx realpath qemu-user-static debootstrap zerofree pxz zip`
+`quilt parted realpath qemu-user-static debootstrap zerofree pxz zip dosfstools bsdtar libcap2-bin grep rsync`
 
-#Config
+## Config
 
 Upon execution, `build.sh` will source the file `config` in the current
 working directory.  This bash shell fragment is intended to set needed
@@ -15,8 +16,18 @@ environment variables.
 
 The following environment variables are supported:
 
- * `IMG_NAME`, the name of the distribution to build (required)
+ * `IMG_NAME` **required** (Default: unset)
- * `APT_PROXY`, proxy/cache URL to be included in the build
+
+   The name of the image to build with the current stage directories.  Setting
+   `IMG_NAME=Raspbian` is logical for an unmodified RPi-Distro/pi-gen build,
+   but you should use something else for a customized version.  Export files
+   in stages may add suffixes to `IMG_NAME`.
+
+ * `APT_PROXY` (Default: unset)
+
+   If you require the use of an apt proxy, set it here.  This proxy setting
+   will not be included in the image, making it safe to use an `apt-cacher` or
+   similar package for development.
 
 A simple example for building Raspbian:
 
@@ -24,17 +35,33 @@ A simple example for building Raspbian:
 IMG_NAME='Raspbian'
 ```
 
-#Stage Anatomy
+## Docker Build
 
+```bash
+vi config         # Edit your config file. See above.
+./build-docker.sh
+```
+If everything goes well, your finished image will be in the `deploy/` folder.
+You can then remove the build container with `docker rm pigen_work`
 
+If something breaks along the line, you can edit the corresponding scripts, and
+continue:
 
-#Raspbian Stage Overview
+```
+CONTINUE=1 ./build-docker.sh
+```
+
+There is a possibility that even when running from a docker container, the installation of `qemu-user-static` will silently fail when building the image because `binfmt-support` _must be enabled on the underlying kernel_. An easy fix is to ensure `binfmt-support` is installed on the host machine before starting the `./build-docker.sh` script (or using your own docker build solution).
+
+## Stage Anatomy
+
+### Raspbian Stage Overview
 
 The build of Raspbian is divided up into several stages for logical clarity
 and modularity.  This causes some initial complexity, but it simplifies
 maintenance and allows for more easy customization.
 
- - Stage 0, bootstrap.  The primary purpose of this stage is to create a
+ - **Stage 0** - bootstrap.  The primary purpose of this stage is to create a
    usable filesystem.  This is accomplished largely through the use of
    `debootstrap`, which creates a minimal filesystem suitable for use as a
    base.tgz on Debian systems.  This stage also configures apt settings and
@@ -42,7 +69,7 @@ maintenance and allows for more easy customization.
    minimal core is installed but not configured, and the system will not quite
    boot yet.
 
- - Stage 1, truly minimal system.  This stage makes the system bootable by
+ - **Stage 1** - truly minimal system.  This stage makes the system bootable by
    installing system files like `/etc/fstab`, configures the bootloader, makes
    the network operable, and installs packages like raspi-config.  At this
    stage the system should boot to a local console from which you have the
@@ -51,7 +78,7 @@ maintenance and allows for more easy customization.
    really usable yet in a traditional sense yet.  Still, if you want minimal,
    this is minimal and the rest you could reasonably do yourself as sysadmin.
 
- - State 2, lite system.  This stage produces the Raspbian-Lite image.  It
+ - **Stage 2** - lite system.  This stage produces the Raspbian-Lite image.  It
    installs some optimized memory functions, sets timezone and charmap
    defaults, installs fake-hwclock and ntp, wifi and bluetooth support,
    dphys-swapfile, and other basics for managing the hardware.  It also
@@ -66,13 +93,25 @@ maintenance and allows for more easy customization.
    you were looking for something between truly minimal and Raspbian-lite,
    here's where you start trimming.
 
- - Stage 3, desktop system.  Here's where you get the full desktop system
+ - **Stage 3** - desktop system.  Here's where you get the full desktop system
    with X11 and LXDE, web browsers, git for development, Raspbian custom UI
    enhancements, etc.  This is a base desktop system, with some development
    tools installed.
 
- - Stage 4, complete Raspbian system.  More development tools, an email
+ - **Stage 4** - complete Raspbian system.  More development tools, an email
    client, learning tools like Scratch, specialized packages like sonic-pi and
    wolfram-engine, system documentation, office productivity, etc.  This is
    the stage that installs all of the things that make Raspbian friendly to
    new users.
+
+### Stage specification
+If you wish to build up to a specified stage (such as building up to stage 2 for a lite system), place an empty file named `SKIP` in each of the `./stage` directories you wish not to include.
+
+Then remove the `EXPORT*` files from `./stage4` (if building up to stage 2) or from `./stage2` (if building a minimal system).
+
+```
+# Example for building a lite system
+$ touch ./stage3/SKIP ./stage4/SKIP
+$ rm stage4/EXPORT*
+```
+If you wish to build further configurations upon (for example) the lite system, you can also delete the contents of `./stage3` and `./stage4` and replace with your own contents in the same format.

build-docker.sh

@@ -0,0 +1,73 @@
+#!/bin/bash -e
+DOCKER="docker"
+set +e
+$DOCKER ps >/dev/null 2>&1
+if [ $? != 0 ]; then
+	DOCKER="sudo docker"
+fi
+if ! $DOCKER ps >/dev/null; then
+	echo "error connecting to docker:"
+	$DOCKER ps
+	exit 1
+fi
+set -e
+
+config_mount=
+if [ -f config ]; then
+	config_mount="-v $(pwd)/config:/pi-gen/config:ro"
+	source config
+fi
+
+CONTAINER_NAME=${CONTAINER_NAME:-pigen_work}
+CONTINUE=${CONTINUE:-0}
+
+if [ "$*" != "" ] || [ -z "${IMG_NAME}" ]; then
+	if [ -z "${IMG_NAME}" ]; then
+		echo "IMG_NAME not set in 'build'" 1>&2
+		echo 1>&2
+	fi
+	cat >&2 <<EOF
+Usage:
+    build-docker.sh [options]
+Optional environment arguments: ( =<default> )
+    CONTAINER_NAME=pigen_work  set a name for the build container
+    CONTINUE=0                  continue from a previously started container
+EOF
+	exit 1
+fi
+
+CONTAINER_EXISTS=$($DOCKER ps -a --filter name="$CONTAINER_NAME" -q)
+CONTAINER_RUNNING=$($DOCKER ps --filter name="$CONTAINER_NAME" -q)
+if [ "$CONTAINER_RUNNING" != "" ]; then
+	echo "The build is already running in container $CONTAINER_NAME. Aborting."
+	exit 1
+fi
+if [ "$CONTAINER_EXISTS" != "" ] && [ "$CONTINUE" != "1" ]; then
+	echo "Container $CONTAINER_NAME already exists and you did not specify CONTINUE=1. Aborting."
+	echo "You can delete the existing container like this:"
+	echo "  docker rm $CONTAINER_NAME"
+	exit 1
+fi
+
+$DOCKER build -t pi-gen .
+if [ "$CONTAINER_EXISTS" != "" ]; then
+	trap "echo 'got CTRL+C... please wait 5s';docker stop -t 5 ${CONTAINER_NAME}_cont" SIGINT SIGTERM
+	time $DOCKER run --rm --privileged \
+		--volumes-from="${CONTAINER_NAME}" --name "${CONTAINER_NAME}_cont" \
+		pi-gen \
+		bash -e -o pipefail -c "dpkg-reconfigure qemu-user-static &&
+	cd /pi-gen; ./build.sh;
+	rsync -av work/*/build.log deploy/" &
+	wait
+else
+	trap "echo 'got CTRL+C... please wait 5s'; docker stop -t 5 ${CONTAINER_NAME}" SIGINT SIGTERM
+	$DOCKER run --name "${CONTAINER_NAME}" --privileged \
+		-v $(pwd)/deploy:/pi-gen/deploy \
+		${config_mount} \
+		pi-gen \
+		bash -e -o pipefail -c "dpkg-reconfigure qemu-user-static &&
+	cd /pi-gen; ./build.sh &&
+	rsync -av work/*/build.log deploy/" &
+	wait
+fi
+echo "Done! Your image(s) should be in deploy/"

build.sh

@@ -7,7 +7,7 @@ run_sub_stage()
 	for i in {00..99}; do
 		if [ -f ${i}-debconf ]; then
 			log "Begin ${SUB_STAGE_DIR}/${i}-debconf"
-			on_chroot sh -e - << EOF
+			on_chroot << EOF
 debconf-set-selections <<SELEOF
 `cat ${i}-debconf`
 SELEOF
@@ -18,7 +18,7 @@ EOF
 			log "Begin ${SUB_STAGE_DIR}/${i}-packages-nr"
 			PACKAGES="$(sed -f "${SCRIPT_DIR}/remove-comments.sed" < ${i}-packages-nr)"
 			if [ -n "$PACKAGES" ]; then
-				on_chroot sh -e - << EOF
+				on_chroot << EOF
 apt-get install --no-install-recommends -y $PACKAGES
 EOF
 			fi
@@ -28,7 +28,7 @@ EOF
 			log "Begin ${SUB_STAGE_DIR}/${i}-packages"
 			PACKAGES="$(sed -f "${SCRIPT_DIR}/remove-comments.sed" < ${i}-packages)"
 			if [ -n "$PACKAGES" ]; then
-				on_chroot sh -e - << EOF
+				on_chroot << EOF
 apt-get install -y $PACKAGES
 EOF
 			fi
@@ -69,7 +69,7 @@ EOF
 		fi
 		if [ -f ${i}-run-chroot ]; then
 			log "Begin ${SUB_STAGE_DIR}/${i}-run-chroot"
-			on_chroot sh -e - < ${i}-run-chroot
+			on_chroot < ${i}-run-chroot
 			log "End ${SUB_STAGE_DIR}/${i}-run-chroot"
 		fi
 	done

depends

@@ -1,5 +1,12 @@
 quilt
+parted
+realpath
 qemu-arm-static:qemu-user-static
 debootstrap
-kpartx zerofree
+zerofree
 pxz zip
+mkdosfs:dosfstools
+capsh:libcap2-bin
+bsdtar
+grep
+rsync

export-image/01-set-sources/01-run.sh

@@ -1,6 +1,6 @@
 #!/bin/bash -e
 
-on_chroot sh -e - <<EOF
+on_chroot << EOF
 apt-get update
 apt-get -y dist-upgrade
 apt-get clean

export-image/03-finalise/01-run.sh

@@ -2,11 +2,15 @@
 
 IMG_FILE="${STAGE_WORK_DIR}/${IMG_DATE}-${IMG_NAME}${IMG_SUFFIX}.img"
 
-on_chroot sh -e - <<EOF
+on_chroot << EOF
 /etc/init.d/fake-hwclock stop
 hardlink -t /usr/share/doc
 EOF
 
+if [ -d ${ROOTFS_DIR}/home/pi/.config ]; then
+	chmod 700 ${ROOTFS_DIR}/home/pi/.config
+fi
+
 rm -f ${ROOTFS_DIR}/etc/apt/apt.conf.d/51cache
 rm -f ${ROOTFS_DIR}/usr/sbin/policy-rc.d
 rm -f ${ROOTFS_DIR}/usr/bin/qemu-arm-static

export-image/prerun.sh

@@ -34,15 +34,27 @@ p
 w
 EOF
 
-LOOP_DEV=`kpartx -asv ${IMG_FILE} | grep -E -o -m1 'loop[[:digit:]]+' | head -n 1`
+PARTED_OUT=$(parted -s ${IMG_FILE} unit b print)
-BOOT_DEV=/dev/mapper/${LOOP_DEV}p1
+BOOT_OFFSET=$(echo "$PARTED_OUT" | grep -e '^ 1'| xargs echo -n \
-ROOT_DEV=/dev/mapper/${LOOP_DEV}p2
+| cut -d" " -f 2 | tr -d B)
+BOOT_LENGTH=$(echo "$PARTED_OUT" | grep -e '^ 1'| xargs echo -n \
+| cut -d" " -f 4 | tr -d B)
 
-mkdosfs -n boot -S 512 -s 16 -v $BOOT_DEV > /dev/null
+ROOT_OFFSET=$(echo "$PARTED_OUT" | grep -e '^ 2'| xargs echo -n \
+| cut -d" " -f 2 | tr -d B)
+ROOT_LENGTH=$(echo "$PARTED_OUT" | grep -e '^ 2'| xargs echo -n \
+| cut -d" " -f 4 | tr -d B)
+
+BOOT_DEV=$(losetup --show -f -o ${BOOT_OFFSET} --sizelimit ${BOOT_LENGTH} ${IMG_FILE})
+ROOT_DEV=$(losetup --show -f -o ${ROOT_OFFSET} --sizelimit ${ROOT_LENGTH} ${IMG_FILE})
+echo "/boot: offset $BOOT_OFFSET, length $BOOT_LENGTH"
+echo "/:     offset $ROOT_OFFSET, length $ROOT_LENGTH"
+
+mkdosfs -n boot -F 32 -v $BOOT_DEV > /dev/null
 mkfs.ext4 -O ^huge_file $ROOT_DEV > /dev/null
 
 mount -v $ROOT_DEV ${ROOTFS_DIR} -t ext4
 mkdir -p ${ROOTFS_DIR}/boot
 mount -v $BOOT_DEV ${ROOTFS_DIR}/boot -t vfat
 
-rsync ${EXPORT_ROOTFS_DIR}/ ${ROOTFS_DIR}/ -aHAX
+rsync -aHAXx ${EXPORT_ROOTFS_DIR}/ ${ROOTFS_DIR}/

export-noobs/00-release/files/partition_setup.sh

@@ -16,8 +16,16 @@ sed /tmp/1/cmdline.txt -i -e "s|root=/dev/[^ ]*|root=${part2}|"
 sed /tmp/2/etc/fstab -i -e "s|^.* / |${part2}  / |"
 sed /tmp/2/etc/fstab -i -e "s|^.* /boot |${part1}  /boot |"
 
+if [ -e /mnt/ssh ]; then
+  cp /mnt/ssh /tmp/1/
+fi
+
+if [ -e /mnt/ssh.txt ]; then
+  cp /mnt/ssh.txt /tmp/1/
+fi
+
 if ! grep -q resize /proc/cmdline; then
-  sed -i 's/ quiet init=.*$//' /tmp/1/cmdline.txt
+  sed -i 's| quiet init=/usr/lib/raspi-config/init_resize.sh||' /tmp/1/cmdline.txt
 fi
 
 umount /tmp/1

export-noobs/00-release/files/partitions.json

@@ -3,6 +3,7 @@
         {
             "filesystem_type": "FAT",
             "label": "boot",
+            "mkfs_options": "-F 32",
             "partition_size_nominal": BOOT_NOM,
             "uncompressed_tarball_size": BOOT_SIZE,
             "want_maximised": false

export-noobs/00-release/files/release_notes.txt

@@ -1,4 +1,44 @@
 UNRELEASED:
+  * Updated kernel and firmware (final Pi Zero W support)
+2017-02-16:
+  * Chromium browser updated to version 56
+  * Adobe Flash Player updated to version 24.0.0.221
+  * RealVNC Server and Viewer updated to version 6.0.2 (RealVNC Connect)
+  * Sonic Pi updated to version 2.11
+  * Node-RED updated to version 0.15.3
+  * Scratch updated to version 120117
+  * Detection of SSH enabled with default password moved into PAM
+  * Updated desktop GL driver to support use of fake KMS option
+  * Raspberry Pi Configuration and raspi-config allow setting of fixed HDMI resolution
+  * raspi-config allows enabling of serial hardware independent of serial terminal
+  * Updates to kernel and firmware
+  * Various minor bug fixes and usability and appearance tweaks
+2017-01-11:
+  * Re-release of the 2016-11-25 image with a FAT32-formatted boot partition
+2016-11-25:
+  * SSH disabled by default; can be enabled by creating a file with name "ssh" in boot partition
+  * Prompt for password change at boot when SSH enabled with default password unchanged
+  * Adobe Flash Player included
+  * Updates to hardware video acceleration in Chromium browser
+  * Greeter now uses background image from last set in Appearance Settings rather than pi user
+  * Updated version of Scratch
+  * Rastrack option removed from raspi-config and Raspberry Pi Configuration
+  * Ability to disable graphical boot splash screen added to raspi-config and Raspberry Pi Configuration
+  * Appearance Settings dialog made tabbed to work better on small screens
+  * Raspberry Pi Configuration now requires current password to change password
+  * Various small bug fixes
+  * Updated firmware and kernel
+2016-09-23:
+  * New PIXEL desktop environment - new icon set, window design, desktop images, splash screen and greeter
+  * Chromium web browser included
+  * Infinality font rendering patches included
+  * RealVNC server and viewer included
+  * SenseHAT emulator included
+  * Rfkill entries added to Wifi and Bluetooth panel plugins
+  * Updates to various standard applications, including Scratch and NodeRED
+  * Various bug fixes, tweaks and translation updates
+  * Updated firmware and kernel (https://github.com/raspberrypi/firmware/commit/ad8608c08b122b2c228dba0ff5070d6e9519faf5)
+2016-05-27:
   * Fixed crash of lxpanel when D-bus not accessible
   * Fixed permissions for D-bus Bluetooth access
   * Removed sudo from shutdown options

export-noobs/prerun.sh

@@ -9,18 +9,30 @@ cp ${WORK_DIR}/export-image/${IMG_DATE}-${IMG_NAME}${IMG_SUFFIX}.img ${STAGE_WOR
 
 rm -rf ${STAGE_WORK_DIR}/${IMG_DATE}-${IMG_NAME}${IMG_SUFFIX}
 
-LOOP_DEV=`kpartx -asv ${IMG_FILE} | grep -E -o -m1 'loop[[:digit:]]+' | head -n 1`
+PARTED_OUT=$(parted -s ${IMG_FILE} unit b print)
-BOOT_DEV=/dev/mapper/${LOOP_DEV}p1
+BOOT_OFFSET=$(echo "$PARTED_OUT" | grep -e '^ 1'| xargs echo -n \
-ROOT_DEV=/dev/mapper/${LOOP_DEV}p2
+| cut -d" " -f 2 | tr -d B)
+BOOT_LENGTH=$(echo "$PARTED_OUT" | grep -e '^ 1'| xargs echo -n \
+| cut -d" " -f 4 | tr -d B)
+
+ROOT_OFFSET=$(echo "$PARTED_OUT" | grep -e '^ 2'| xargs echo -n \
+| cut -d" " -f 2 | tr -d B)
+ROOT_LENGTH=$(echo "$PARTED_OUT" | grep -e '^ 2'| xargs echo -n \
+| cut -d" " -f 4 | tr -d B)
+
+BOOT_DEV=$(losetup --show -f -o ${BOOT_OFFSET} --sizelimit ${BOOT_LENGTH} ${IMG_FILE})
+ROOT_DEV=$(losetup --show -f -o ${ROOT_OFFSET} --sizelimit ${ROOT_LENGTH} ${IMG_FILE})
+echo "/boot: offset $BOOT_OFFSET, length $BOOT_LENGTH"
+echo "/:     offset $ROOT_OFFSET, length $ROOT_LENGTH"
 
 mkdir -p ${STAGE_WORK_DIR}/rootfs
-mkdir -p ${STAGE_WORK_DIR}/bootfs
 mkdir -p ${NOOBS_DIR}
 
 mount $ROOT_DEV ${STAGE_WORK_DIR}/rootfs
-mount $BOOT_DEV ${STAGE_WORK_DIR}/bootfs
+mount $BOOT_DEV ${STAGE_WORK_DIR}/rootfs/boot
 
-tar -I pxz -C ${STAGE_WORK_DIR}/bootfs -cpf ${NOOBS_DIR}/boot.tar.xz .
+bsdtar --format gnutar --use-compress-program pxz -C ${STAGE_WORK_DIR}/rootfs/boot -cpf ${NOOBS_DIR}/boot.tar.xz .
-tar -I pxz -C ${STAGE_WORK_DIR}/rootfs -cpf ${NOOBS_DIR}/root.tar.xz .
+umount ${STAGE_WORK_DIR}/rootfs/boot
+bsdtar --format gnutar --use-compress-program pxz -C ${STAGE_WORK_DIR}/rootfs --one-file-system -cpf ${NOOBS_DIR}/root.tar.xz .
 
 unmount_image ${IMG_FILE}

scripts/common

@@ -1,10 +1,11 @@
 log (){
-	date +"[%T] $@" | tee -a ${LOG_FILE}
+	date +"[%T] $@" | tee -a "${LOG_FILE}"
 }
 export -f log
 
 bootstrap(){
-	local ARCH=$(dpkg --print-architecture)
+	local ARCH
+	ARCH=$(dpkg --print-architecture)
 
 	export http_proxy=${APT_PROXY}
 
@@ -14,20 +15,20 @@ bootstrap(){
 		local BOOTSTRAP_CMD=debootstrap
 	fi
 
-	${BOOTSTRAP_CMD} --components=main,contrib,non-free \
+	capsh --drop=cap_setfcap -- -c "${BOOTSTRAP_CMD} --components=main,contrib,non-free \
 		--arch armhf\
 		--no-check-gpg \
-		$1 $2 $3
+		$1 $2 $3"
 }
 export -f bootstrap
 
 copy_previous(){
-	if [ ! -d ${PREV_ROOTFS_DIR} ]; then
+	if [ ! -d "${PREV_ROOTFS_DIR}" ]; then
 		echo "Previous stage rootfs not found"
 		false
 	fi
-	mkdir -p ${ROOTFS_DIR}
+	mkdir -p "${ROOTFS_DIR}"
-	rsync -aHAX ${PREV_ROOTFS_DIR}/ ${ROOTFS_DIR}/
+	rsync -aHAXx "${PREV_ROOTFS_DIR}/" "${ROOTFS_DIR}/"
 }
 export -f copy_previous
 
@@ -38,10 +39,11 @@ unmount(){
 		DIR=$1
 	fi
 
-	while mount | grep -q $DIR; do
+	while mount | grep -q "$DIR"; do
-		local LOCS=`mount | grep $DIR | cut -f 3 -d ' ' | sort -r`
+		local LOCS
+		LOCS=$(mount | grep "$DIR" | cut -f 3 -d ' ' | sort -r)
 		for loc in $LOCS; do
-			umount $loc
+			umount "$loc"
 		done
 	done
 }
@@ -50,42 +52,47 @@ export -f unmount
 unmount_image(){
 	sync
 	sleep 1
-	local LOOP_DEV=$(losetup -j ${1} | cut -f1 -d':')
+	local LOOP_DEVICES
-	if [ -n "${LOOP_DEV}" ]; then
+	LOOP_DEVICES=$(losetup -j "${1}" | cut -f1 -d':')
-		local MOUNTED_DIR=$(mount | grep $(basename ${LOOP_DEV} | head -n 1 | cut -f 3 -d ' '))
+	for LOOP_DEV in ${LOOP_DEVICES}; do
-		if [ -n "${MOUNTED_DIR}" ]; then
+		if [ -n "${LOOP_DEV}" ]; then
-			unmount $(dirname ${MOUNTED_DIR})
+			local MOUNTED_DIR
+			MOUNTED_DIR=$(mount | grep "$(basename "${LOOP_DEV}")" | head -n 1 | cut -f 3 -d ' ')
+			if [ -n "${MOUNTED_DIR}" ] && [ "${MOUNTED_DIR}" != "/" ]; then
+				unmount "$(dirname "${MOUNTED_DIR}")"
+			fi
+			sleep 1
+			losetup -d "${LOOP_DEV}"
 		fi
-		sleep 1
+	done
-		kpartx -ds ${LOOP_DEV}
-		losetup -d ${LOOP_DEV}
-	fi
 }
 export -f unmount_image
 
 on_chroot() {
-	if ! mount | grep -q `realpath ${ROOTFS_DIR}/proc`; then
+	if ! mount | grep -q "$(realpath "${ROOTFS_DIR}"/proc)"; then
-		mount -t proc proc ${ROOTFS_DIR}/proc
+		mount -t proc proc "${ROOTFS_DIR}/proc"
 	fi
 
-	if ! mount | grep -q `realpath ${ROOTFS_DIR}/dev`; then
+	if ! mount | grep -q "$(realpath "${ROOTFS_DIR}"/dev)"; then
-		mount --bind /dev ${ROOTFS_DIR}/dev
+		mount --bind /dev "${ROOTFS_DIR}/dev"
 	fi
 	
-	if ! mount | grep -q `realpath ${ROOTFS_DIR}/dev/pts`; then
+	if ! mount | grep -q "$(realpath "${ROOTFS_DIR}"/dev/pts)"; then
-		mount --bind /dev/pts ${ROOTFS_DIR}/dev/pts
+		mount --bind /dev/pts "${ROOTFS_DIR}/dev/pts"
 	fi
 
-	if ! mount | grep -q `realpath ${ROOTFS_DIR}/sys`; then
+	if ! mount | grep -q "$(realpath "${ROOTFS_DIR}"/sys)"; then
-		mount --bind /sys ${ROOTFS_DIR}/sys
+		mount --bind /sys "${ROOTFS_DIR}/sys"
 	fi
 
-	chroot ${ROOTFS_DIR}/ "$@"
+	capsh --drop=cap_setfcap "--chroot=${ROOTFS_DIR}/" -- "$@"
 }
 export -f on_chroot
 
 update_issue() {
-	local GIT_HASH=$(git rev-parse HEAD)
+	local GIT_HASH
-	echo -e "Raspberry Pi reference ${IMG_DATE}\nGenerated using pi-gen, https://github.com/RPi-Distro/pi-gen, ${GIT_HASH}, ${1}" > ${ROOTFS_DIR}/etc/rpi-issue
+	GIT_HASH=$(git rev-parse HEAD)
+	echo -e "Raspberry Pi reference ${IMG_DATE}\nGenerated using pi-gen, https://github.com/RPi-Distro/pi-gen, ${GIT_HASH}, ${1}" > "${ROOTFS_DIR}/etc/rpi-issue"
 }
 export -f update_issue
+

stage0/01-configure-apt/00-run.sh

@@ -11,7 +11,7 @@ else
 fi
 
 on_chroot apt-key add - < files/raspberrypi.gpg.key
-on_chroot sh -e - << EOF
+on_chroot << EOF
 apt-get update
 apt-get dist-upgrade -y
 EOF

stage1/01-sys-tweaks/00-run.sh

@@ -5,7 +5,7 @@ install -m 644 files/noclear.conf ${ROOTFS_DIR}/etc/systemd/system/[email protected]
 install -m 744 files/policy-rc.d ${ROOTFS_DIR}/usr/sbin/policy-rc.d #TODO: Necessary in systemd?
 install -v -m 644 files/fstab ${ROOTFS_DIR}/etc/fstab
 
-on_chroot sh -e - <<EOF
+on_chroot << EOF
 if ! id -u pi >/dev/null 2>&1; then
 	adduser --disabled-password --gecos "" pi
 fi

stage1/02-net-tweaks/00-run.sh

@@ -4,6 +4,6 @@ install -m 644 files/ipv6.conf ${ROOTFS_DIR}/etc/modprobe.d/ipv6.conf
 install -m 644 files/interfaces ${ROOTFS_DIR}/etc/network/interfaces
 install -m 644 files/hostname ${ROOTFS_DIR}/etc/hostname
 
-on_chroot sh -e - << EOF
+on_chroot << EOF
 dpkg-divert --add --local /lib/udev/rules.d/75-persistent-net-generator.rules
 EOF

stage2/01-sys-tweaks/00-debconf

@@ -1,6 +1,13 @@
 # Encoding to use on the console:
 # Choices: ARMSCII-8, CP1251, CP1255, CP1256, GEORGIAN-ACADEMY, GEORGIAN-PS, IBM1133, ISIRI-3342, ISO-8859-1, ISO-8859-10, ISO-8859-11, ISO-8859-13, ISO-8859-14, ISO-8859-15, ISO-8859-16, ISO-8859-2, ISO-8859-3, ISO-8859-4, ISO-8859-5, ISO-8859-6, ISO-8859-7, ISO-8859-8, ISO-8859-9, KOI8-R, KOI8-U, TIS-620, UTF-8, VISCII
-console-setup	console-setup/charmap47	select	UTF-8
+console-setup   console-setup/charmap47 select  UTF-8
+# Character set to support:
+# Choices: . Arabic, # Armenian, # Cyrillic - KOI8-R and KOI8-U, # Cyrillic - non-Slavic languages, # Cyrillic - Slavic languages (also Bosnian and Serbian Latin), . Ethiopic, # Georgian, # Greek, # Hebrew, # Lao, # Latin1 and Latin5 - western Europe and Turkic languages, # Latin2 - central Europe and Romanian, # Latin3 and Latin8 - Chichewa; Esperanto; Irish; Maltese and Welsh, # Latin7 - Lithuanian; Latvian; Maori and Marshallese, . Latin - Vietnamese, # Thai, . Combined - Latin; Slavic Cyrillic; Hebrew; basic Arabic, . Combined - Latin; Slavic Cyrillic; Greek, . Combined - Latin; Slavic and non-Slavic Cyrillic, Guess optimal character set
+console-setup   console-setup/codeset47 select  Guess optimal character set
+# Font for the console:
+# Choices: Fixed, Goha, GohaClassic, Terminus, TerminusBold, TerminusBoldVGA, VGA, Do not change the boot/kernel font, Let the 
+system select a suitable font
+console-setup   console-setup/fontface47        select  Do not change the boot/kernel font
 # Geographic area:
 # Choices: Africa, America, Antarctica, Australia, Arctic Ocean, Asia, Atlantic Ocean, Europe, Indian Ocean, Pacific Ocean, System V timezones, US, None of the above
 tzdata	tzdata/Areas	select	Etc

stage2/01-sys-tweaks/00-packages

@@ -14,3 +14,4 @@ raspberrypi-sys-mods
 pi-bluetooth
 apt-listchanges
 usb-modeswitch
+apt-transport-https

stage2/01-sys-tweaks/00-patches/00-sudoers.diff

@@ -1,10 +0,0 @@
-Index: jessie-stage2/rootfs/etc/sudoers
-===================================================================
---- jessie-stage2.orig/rootfs/etc/sudoers
-+++ jessie-stage2/rootfs/etc/sudoers
-@@ -25,3 +25,5 @@ root	ALL=(ALL:ALL) ALL
- # See sudoers(5) for more information on "#include" directives:
- 
- #includedir /etc/sudoers.d
-+
-+pi ALL=(ALL) NOPASSWD: ALL

stage2/01-sys-tweaks/00-patches/03-console-setup.diff

@@ -1,17 +0,0 @@
-Index: jessie-stage2/rootfs/etc/default/console-setup
-===================================================================
---- jessie-stage2.orig/rootfs/etc/default/console-setup
-+++ jessie-stage2/rootfs/etc/default/console-setup
-@@ -6,9 +6,9 @@ ACTIVE_CONSOLES="/dev/tty[1-6]"
- 
- CHARMAP="UTF-8"
- 
--CODESET="Lat15"
--FONTFACE="Fixed"
--FONTSIZE="8x16"
-+CODESET="guess"
-+FONTFACE=""
-+FONTSIZE=""
- 
- VIDEOMODE=
- 

stage2/01-sys-tweaks/00-patches/series

@@ -1,7 +1,5 @@
-00-sudoers.diff
 01-useradd.diff
 02-swap.diff
-03-console-setup.diff
 04-inputrc.diff
 05-path.diff
 06-rc_local.diff

stage2/01-sys-tweaks/01-run.sh

@@ -1,6 +1,6 @@
 #!/bin/bash -e
 
-install -m 755 files/regenerate_ssh_host_keys		${ROOTFS_DIR}/etc/init.d/
+install -m 644 files/regenerate_ssh_host_keys.service	${ROOTFS_DIR}/lib/systemd/system/
 install -m 755 files/apply_noobs_os_config		${ROOTFS_DIR}/etc/init.d/
 install -m 755 files/resize2fs_once			${ROOTFS_DIR}/etc/init.d/
 
@@ -9,8 +9,9 @@ install -m 644 files/ttyoutput.conf			${ROOTFS_DIR}/etc/systemd/system/rc-local.
 
 install -m 644 files/50raspi				${ROOTFS_DIR}/etc/apt/apt.conf.d/
 
+install -m 644 files/console-setup   			${ROOTFS_DIR}/etc/default/
 
-on_chroot sh -e - <<EOF
+on_chroot << EOF
 systemctl disable hwclock.sh
 systemctl disable nfs-common
 systemctl disable rpcbind
@@ -20,7 +21,7 @@ systemctl enable apply_noobs_os_config
 systemctl enable resize2fs_once
 EOF
 
-on_chroot sh -e - << \EOF
+on_chroot << \EOF
 for GRP in input spi i2c gpio; do
 	groupadd -f -r $GRP
 done
@@ -29,11 +30,11 @@ for GRP in adm dialout cdrom audio users sudo video games plugdev input gpio spi
 done
 EOF
 
-on_chroot sh -e - <<EOF
+on_chroot << EOF
 setupcon --force --save-only -v
 EOF
 
-on_chroot sh -e - <<EOF
+on_chroot << EOF
 usermod --pass='*' root
 EOF
 

stage2/01-sys-tweaks/files/console-setup

@@ -0,0 +1,16 @@
+# CONFIGURATION FILE FOR SETUPCON
+
+# Consult the console-setup(5) manual page.
+
+ACTIVE_CONSOLES="/dev/tty[1-6]"
+
+CHARMAP="UTF-8"
+
+CODESET="guess"
+FONTFACE=""
+FONTSIZE=""
+
+VIDEOMODE=
+
+# The following is an example how to use a braille font
+# FONT='lat9w-08.psf.gz brl-8x8.psf'

stage2/01-sys-tweaks/files/regenerate_ssh_host_keys

@@ -1,36 +0,0 @@
-#!/bin/sh
-### BEGIN INIT INFO
-# Provides:          regenerate_ssh_host_keys
-# Required-Start:
-# Required-Stop:
-# Default-Start: 2
-# Default-Stop:
-# Short-Description: Regenerate ssh host keys
-# Description:
-### END INIT INFO
-
-. /lib/lsb/init-functions
-
-set -e
-
-case "$1" in
-  start)
-    log_daemon_msg "Regenerating ssh host keys (in background)"
-    nohup sh -c "if [ -e /dev/hwrng ]; then
-          dd if=/dev/hwrng of=/dev/urandom count=1 bs=4096
-      fi; \
-      yes | ssh-keygen -q -N '' -t dsa -f /etc/ssh/ssh_host_dsa_key && \
-      yes | ssh-keygen -q -N '' -t rsa -f /etc/ssh/ssh_host_rsa_key && \
-      yes | ssh-keygen -q -N '' -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key && \
-      yes | ssh-keygen -q -N '' -t ed25519 -f /etc/ssh/ssh_host_ed25519_key && \
-      systemctl enable ssh && sync && \
-      rm /etc/init.d/regenerate_ssh_host_keys && \
-      update-rc.d regenerate_ssh_host_keys remove && \
-      printf '\nfinished\n' && systemctl start ssh" > /var/log/regen_ssh_keys.log 2>&1 &
-    log_end_msg $?
-    ;;
-  *)
-    echo "Usage: $0 start" >&2
-    exit 3
-    ;;
-esac

stage2/01-sys-tweaks/files/regenerate_ssh_host_keys.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Regenerate SSH host keys
+
+[Service]
+Type=oneshot
+ExecStartPre=/bin/sh -c "if [ -e /dev/hwrng ]; then dd if=/dev/hwrng of=/dev/urandom count=1 bs=4096; fi"
+ExecStart=/usr/bin/ssh-keygen -A
+ExecStartPost=/bin/rm /lib/systemd/system/regenerate_ssh_host_keys.service ; /usr/sbin/update-rc.d regenerate_ssh_host_keys remove
+
+[Install]
+WantedBy=multi-user.target

stage2/02-net-tweaks/00-packages

@@ -1,2 +1,3 @@
 wpasupplicant wireless-tools firmware-atheros firmware-brcm80211 firmware-libertas firmware-ralink firmware-realtek
+raspberrypi-net-mods
 dhcpcd5

stage2/02-net-tweaks/00-patches/00-interfaces.diff

@@ -1,27 +0,0 @@
-Index: jessie-stage2/rootfs/etc/network/interfaces
-===================================================================
---- jessie-stage2.orig/rootfs/etc/network/interfaces
-+++ jessie-stage2/rootfs/etc/network/interfaces
-@@ -1,4 +1,20 @@
--auto lo
-+# interfaces(5) file used by ifup(8) and ifdown(8)
-+
-+# Please note that this file is written to be used with dhcpcd
-+# For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf'
- 
-+# Include files from /etc/network/interfaces.d:
-+source-directory /etc/network/interfaces.d
-+
-+auto lo
- iface lo inet loopback
--iface eth0 inet dhcp
-+
-+iface eth0 inet manual
-+
-+allow-hotplug wlan0
-+iface wlan0 inet manual
-+    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
-+
-+allow-hotplug wlan1
-+iface wlan1 inet manual
-+    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

stage2/02-net-tweaks/00-patches/series

@@ -1 +0,0 @@
-00-interfaces.diff

stage2/03-cleanup/00-run.sh

@@ -1,5 +1,5 @@
 #!/bin/bash -e
 
-on_chroot sh -e - <<EOF
+on_chroot << EOF
 apt-get clean
 EOF

stage3/00-install-packages/00-debconf

@@ -0,0 +1,2 @@
+# Adobe Flash Player. Copyright 1996-2015. Adobe Systems Incorporated. All Rights Reserved.
+rpi-chromium-mods	rpi-chromium-mods/adobe	note

stage3/00-install-packages/00-packages

@@ -5,6 +5,6 @@ git-core rpi-update
 omxplayer
 raspberrypi-artwork
 policykit-1
-udisks
+gvfs
 rfkill
 chromium-browser rpi-chromium-mods

stage3/00-install-packages/01-run.sh

@@ -1,6 +1,6 @@
 #!/bin/bash -e
 
-on_chroot sh -e - <<EOF
+on_chroot << EOF
 update-alternatives --install /usr/bin/x-www-browser \
   x-www-browser /usr/bin/chromium-browser 86
 update-alternatives --install /usr/bin/gnome-www-browser \

stage3/01-tweaks/00-patches/01-lightdm.diff

@@ -1,13 +0,0 @@
-Index: jessie-stage3/rootfs/etc/lightdm/lightdm-gtk-greeter.conf
-===================================================================
---- jessie-stage3.orig/rootfs/etc/lightdm/lightdm-gtk-greeter.conf
-+++ jessie-stage3/rootfs/etc/lightdm/lightdm-gtk-greeter.conf
-@@ -16,7 +16,7 @@
- # screensaver-timeout = Timeout (in seconds) until the screen blanks when the greeter is called as lockscreen
- # 
- [greeter]
--background=/usr/share/images/desktop-base/login-background.svg
-+background=#ffffff
- theme-name=Adwaita
- #icon-theme-name=
- #font-name=

stage3/01-tweaks/00-patches/series

@@ -1 +0,0 @@
-01-lightdm.diff

stage3/01-tweaks/00-run.sh

@@ -1,15 +1,3 @@
 #!/bin/bash -e
 
-on_chroot sh -e - <<EOF
+rm -f ${ROOTFS_DIR}/etc/systemd/system/dhcpcd.service.d/wait.conf
-update-alternatives --set libgksu-gconf-defaults /usr/share/libgksu/debian/gconf-defaults.libgksu-sudo
-update-gconf-defaults
-EOF
-
-on_chroot sh -e - <<EOF
-update-alternatives --install /usr/share/images/desktop-base/desktop-background \
-desktop-background /usr/share/raspberrypi-artwork/raspberry-pi-logo.png 100
-EOF
-
-rm -f							${ROOTFS_DIR}/etc/systemd/system/dhcpcd.service.d/wait.conf
-install -m 644 files/55-storage.pkla			${ROOTFS_DIR}/etc/polkit-1/localauthority/50-local.d/
-install -m 644 files/75source-profile		${ROOTFS_DIR}/etc/X11/Xsession.d/

stage3/01-tweaks/files/55-storage.pkla

@@ -1,6 +0,0 @@
-[Storage Permissions]
-Identity=unix-group:plugdev
-Action=org.freedesktop.udisks.filesystem-mount;org.freedesktop.udisks.drive-eject;org.freedesktop.udisks.drive-detach;org.freedesktop.udisks.luks-unlock;org.freedesktop.udisks.inhibit-polling;org.freedesktop.udisks.drive-set-spindown
-ResultAny=yes
-ResultActive=yes
-ResultInactive=no

stage3/01-tweaks/files/75source-profile

@@ -1,2 +0,0 @@
-[ -f /etc/profile ] && . /etc/profile
-[ -f "$HOME/.profile" ] && . "$HOME/.profile"

stage4/00-install-packages/00-packages

@@ -27,10 +27,10 @@ piclone
 pulseaudio-module-bluetooth
 wiringpi pigpio python-pigpio python3-pigpio raspi-gpio python-gpiozero python3-gpiozero python3-rpi.gpio
 python-spidev python3-spidev
-realvnc-vnc-server realvnc-vnc-viewer
 python-twython python3-twython
 python-smbus python3-smbus
 python-flask python3-flask
 python-picraft python3-picraft
 python3-codebug-tether python3-codebug-i2c-tether
 python-sense-emu python3-sense-emu sense-emu-tools python-sense-emu-doc
+pprompt

stage4/00-install-packages/00-packages-nr

@@ -1,3 +1,4 @@
 libreoffice libreoffice-gtk
 timidity
 pi-package
+realvnc-vnc-server realvnc-vnc-viewer

stage4/01-console-autologin/00-run.sh

@@ -1,5 +1,3 @@
 #!/bin/bash -e
 
 ln -sf /etc/systemd/system/[email protected] ${ROOTFS_DIR}/etc/systemd/system/getty.target.wants/[email protected]
-
-install -v -m 644 files/40-scratch.rules ${ROOTFS_DIR}/etc/udev/rules.d/

stage4/01-tweaks/files/40-scratch.rules

@@ -1 +0,0 @@
-ATTRS{idVendor}=="0694", ATTRS{idProduct}=="0003", SUBSYSTEMS=="usb", ACTION=="add", MODE="0666", GROUP="plugdev"

stage4/02-extras/00-patches/0-autologin.diff

@@ -1,13 +0,0 @@
-Index: jessie-stage4/rootfs/etc/lightdm/lightdm.conf
-===================================================================
---- jessie-stage4.orig/rootfs/etc/lightdm/lightdm.conf
-+++ jessie-stage4/rootfs/etc/lightdm/lightdm.conf
-@@ -114,7 +114,7 @@
- #session-setup-script=
- #session-cleanup-script=
- #autologin-guest=false
--#autologin-user=
-+autologin-user=pi
- #autologin-user-timeout=0
- #autologin-in-background=false
- #autologin-session=UNIMPLEMENTED

stage4/02-extras/00-patches/series

@@ -1 +0,0 @@
-0-autologin.diff

stage4/02-extras/00-run.sh

@@ -31,28 +31,3 @@ install -v -o 1000 -g 1000 -d "${ROOTFS_DIR}/home/pi/.local"
 install -v -o 1000 -g 1000 -d "${ROOTFS_DIR}/home/pi/.local/share"
 install -v -o 1000 -g 1000 -d "${ROOTFS_DIR}/home/pi/.local/share/applications"
 install -v -o 1000 -g 1000 -d "${ROOTFS_DIR}/home/pi/.local/share/desktop-directories"
-
-install -v -o 1000 -g 1000 -d ${ROOTFS_DIR}/home/pi/.config
-install -v -o 1000 -g 1000 -d ${ROOTFS_DIR}/home/pi/.config/pcmanfm
-install -v -o 1000 -g 1000 -d ${ROOTFS_DIR}/home/pi/.config/pcmanfm/LXDE-pi
-install -v -o 1000 -g 1000 -d ${ROOTFS_DIR}/home/pi/.config/openbox
-install -v -o 1000 -g 1000 -d ${ROOTFS_DIR}/home/pi/.config/lxsession
-install -v -o 1000 -g 1000 -d ${ROOTFS_DIR}/home/pi/.themes
-install -v -o 1000 -g 1000 -d ${ROOTFS_DIR}/home/pi/.config/gtk-3.0
-install -v -o 1000 -g 1000 -d ${ROOTFS_DIR}/home/pi/.config/lxpanel
-install -v -o 1000 -g 1000 -d ${ROOTFS_DIR}/home/pi/Desktop
-
-install -v -m 644 -o 1000 -g 1000 ${ROOTFS_DIR}/etc/xdg/pcmanfm/LXDE-pi/pcmanfm.conf ${ROOTFS_DIR}/home/pi/.config/pcmanfm/LXDE-pi/
-install -v -m 644 -o 1000 -g 1000 ${ROOTFS_DIR}/etc/xdg/pcmanfm/LXDE-pi/desktop-items-0.conf ${ROOTFS_DIR}/home/pi/.config/pcmanfm/LXDE-pi/
-
-install -v -m 644 -o 1000 -g 1000 ${ROOTFS_DIR}/etc/xdg/openbox/lxde-pi-rc.xml ${ROOTFS_DIR}/home/pi/.config/openbox/
-
-rsync -a --chown=1000:1000 ${ROOTFS_DIR}/etc/xdg/lxsession/LXDE-pi ${ROOTFS_DIR}/home/pi/.config/lxsession/
-rsync -a --chown=1000:1000 ${ROOTFS_DIR}/usr/share/themes/PiX ${ROOTFS_DIR}/home/pi/.themes/
-
-install -v -m 644 -o 1000 -g 1000 ${ROOTFS_DIR}/usr/share/raspi-ui-overrides/gtk.css ${ROOTFS_DIR}/home/pi/.config/gtk-3.0/
-
-install -v -m 644 -o 1000 -g 1000 ${ROOTFS_DIR}/usr/share/raspi-ui-overrides/Trolltech.conf ${ROOTFS_DIR}/home/pi/.config/
-
-install -v -m 644 -o 1000 -g 1000 ${ROOTFS_DIR}/etc/xdg/lxpanel/launchtaskbar.cfg ${ROOTFS_DIR}/home/pi/.config/lxpanel/
-rsync -a --chown=1000:1000 ${ROOTFS_DIR}/etc/xdg/lxpanel/profile/LXDE-pi ${ROOTFS_DIR}/home/pi/.config/lxpanel/

stage4/03-cleanup/00-run.sh

@@ -1,5 +1,5 @@
 #!/bin/bash -e
 
-on_chroot sh -e - <<EOF
+on_chroot << EOF
 apt-get clean
 EOF